[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Digital Identity Guidelines:

Additional information about this publication is available at https://csrc.nist.gov/pubs/
sp/800/63/4/final, including related content, potential updates, and document history.

3.7.

collection, maintenance, use, and disclosure of information about individuals that
is maintained by federal agencies in systems of records


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security:

| Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi   |
|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction .........................................................................................................................1 | 1. Introduction .........................................................................................................................1 | 1.

Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers” support CMMC certification?

[Assistant]
According to Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”:

ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-05-06

## How to Cite this NIST Technical Series Publication

Megas, K, Fagan M, Cuthill B, Hoehn B , Petrella E (2025) Workshop Summary Report for 'Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers' . (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8572. https://doi.org/10.6028/NIST.IR.8572

## Author ORCID iDs

Katerina Megas: 0000-0002-2815-5448

Michael Fagan: 0000-0002-1861-2609

Barbara Cuthill: 0000-0002-2588-6165

## Contact Information

iotsecurity@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8572/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

This report summarizes discussions held at the March 5, 2025 "Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers' organized by the NIST Cybersecurity for the Internet of Things (IoT) program.

Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program provide? (Part 2)

[Assistant]
may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-11-04 Supersedes NIST SP 800-55 Rev.

Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management:

The device type or sub- components do not meet organization defined rules (for removal and/or connection). | Assessment Criteria Notes: 1) The actual state includes four parts: a. the actual hardware configuration of devices approved for removal. The hardware configuration typically consists of the presence or absence of specific hardware subcomponents (e.g., DVD drives, USB ports). b. data identifying devices about to be used in travel (and to where). c. users authorized to take the devices on travel. d. data identifying devices reentering the assessment boundary (and where else the device has been connected while removed - this might be validated from GPS and IP logging, if appropriate). 2) The desired state includes two parts: a. the list of devices authorized for removal; and b. the desired hardware configuration and/or sanitization for such devices, based on connections while removed. [Reference 1a and 1d, above.] 3) A defect occurs when: a. any device unauthorized for removal is either expected to be (or has actually been) removed, regardless of hardware configuration. b. a device approved for travel does not have the desired hardware configuration for the proposed uses. c. a device approved for travel was connected to unapproved location(s) where its hardware configuration was not appropriate (matching the desired state) for those location(s). | TBD        |

Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guide to Information Technology Security Services provide?

[Assistant]
<!-- image -->

Special Publication 800-35

## Guide to Information Technology Security Services

Recommendations of the National Institute of Standards and T echnology

Tim Grance Joan Hash Marc Stevens Kristofor O'Neal Nadya Bartol

Special Publication 800-35

## Guide to Information Technology Security Services

The National Institute of Standards and Technology

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

<!-- image -->

October 2003

U.S. Department of Commerce Donald L. Evans, Secretary

Technology Administration Phillip J. Bond, Under Secretary for Technology

National Institute of Standards and Technology Arden L. Bement, Jr., Director

## Acknowledgements

The authors, Tim Grance and Joan Hash of the National Institute of Standards and Technology (NIST), and Marc Stevens, Kristofor O'Neal, and Nadya Bartol, of Booz Allen Hamilton (BAH), wish to thank their colleagues who reviewed the many drafts of this document and contributed to its technical content. We also gratefully acknowledge and appreciate the many comments we received from readers of the public and private sectors, whose valuable insights improved the quality and usefulness of this document. The authors would like to specifically acknowledge some key organizations whose extensive feedback substantially contributed to the development of the document. These organizations include: Environmental Protection Agency, Department of Treasury, Tennessee Valley Authority, and Electronic Data Systems. The authors would also like to acknowledge Ron Ross, Gary Stoneburner, Curtis Barker, Ron Tencati, Marianne Swanson, and Bill Burr of NIST, Alexis Feringa, Don Ottinger, Skip Hirsh, and Robert Young, BAH, and Shirley Radack for their extensive review and comment and keen and insightful assistance throughout the development of the document.

Guide to Information Technology Security Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to An Introduction to Information Security:

3.2.3 Using the System Security Plan (SSP)

The system security plan provides implementation details against which the system can be audited.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Security Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security:

.....................................................1 | 1. Introduction .........................................................................................................................1 | 1.
Introduction .........................................................................................................................1 |                                                                                |
|                                                                                | 1.1                                                                                | Purpose and Scope                                                                                | ....................................................................................................1                                    |
|                                                                                | 1.2                                                                                | Audience.....................................................................................................................1             |                                                                                |
|                                                                                | 1.3                                                                                | Document Structure....................................................................................................1                    |                                                                                |
| 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. The authors, Kerry McKay and David Cooper of the National Institute of Standards and Technology (NIST), would like to thank the many people who assisted with the development of this document. In particular, we would like to acknowledge Tim Polk of NIST and Santosh Chokhani of CygnaCom Solutions, who were co-authors on the first revision of this document. We would also like to acknowledge Matthew J. Fanto and C.

Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to PIV Data Model Test Guidelines:

A robust testing framework and guidance to provide assurance that a particular component or system is compliant with FIPS201 and supporting standards should exist to build the necessary PIV infrastructure to support common unified processes and systems for government-wide use. NIST developed test guidance in two parts. The first part addresses test requirements for interface to the PIV card and are provided in SP80085A. The second part provides test requirements for the PIV data model and is provided in this document. This document specifies the derived test requirements, and the detailed test assertions and conformance tests for testing the PIV data model. | 1. | Introduction ............................................................................................................1   | Introduction ............................................................................................................1   |
|------|------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
|      | 1.1 Authority                                                                                | ..........................................................................................................1                  |
|      | 1.2 Purpose                                                                                | and Scope.........................................................................................1                          |
|      | 1.3 Audience                                                                                | and Assumptions.............................................................................2                                |
| 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

f configuration setting information from an endpoint using OVAL [19]. A NEA extension will be developed to allow for event-driven and ad-hoc OVAL-based collection of configuration setting information.
The OVAL and SCAP communities have requested improvements to OVAL that need to be considered to better integrate OVAL with other SCAP specifications, to improve OVAL functionality, to make OVAL content easier to create, and to increase overall OVAL adoption. These updates are expected to be worked on in an international standards organization.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Zero Trust Architecture:

Desde hace más de una década se insta a los organismos federales a cambiar hacia una protección basada en estos nuevos principios, mediante la creación de prestaciones y políticas como la Ley Federal de Gestión de Seguridad de la Información (FISMA por su nombre en inglés Federal Information Security Modernization Act); seguida del Marco de Gestión de Riesgos (RMF por su apelación en inglés Risk Management Framework); la Gestión Federal de Identidades, Credenciales y Accesos (FICAM, por su nombre en inglés Federal Identity,

Credential, and Access Management); la Conexión a Internet de confianza TIC (por su nombre en inglés Trusted Internet Connections), y los programas de Diagnóstico y Mitigación Continuos (CDM por su denominación en inglés Continuous Diagnostics and Mitigation). Todos estos planes tienen como objetivo restringir el acceso a los datos y a los recursos a las partes autorizadas. Cuando se iniciaron estos programas, estaban limitados por las capacidades técnicas de los sistemas de información. Las políticas de seguridad eran mayormente estáticas y se aplicaban en grandes «cuellos de botella» al alcance de la empresa para obtener el mejor resultado posible. A medida que la tecnología se consolida, se están pudiendo analizar y evaluar continuamente las solicitudes de acceso de forma dinámica y granular, sobre una base de «necesidad de acceso» que permite mitigar la exposición de los datos ocasionada por cuentas comprometidas, atacantes que monitorean las redes y otras amenazas. 6. Toda autentificación y autorización a un recurso es dinámica y se aplica de forma estricta antes de permitir el acceso . Se trata de un ciclo constante de acceso, escaneo y evaluación de amenazas, adaptación y reevaluación continua de la confianza en permanente comunicación.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Security of SQL-Based Implementations of Product Data Exchange Using STEP:

This paper is intended for designers of systems and databases that use SQL in implementing STEP. With [PB93], this paper will help to evaluate the security controls of SQL with respect to different security policies. This evaluation should help determine the types of controls and mechanisms that will be required from the SQL processor(s), as well as other components of the system (such as operating system (OS) controls, network protocols, and identification and authentication mechanisms).

The interface between the SQL processor and STEP applications may utilize the embedded SQL language or the STEP Data Access Interface (SDAI) interface. The application must supply accurate information regarding the identity of the user to the SQL processor. This places two requirements on the system: appropriate selection

and management of identification and authentication (I&A) controls and control of this critical attribute's propagation.

Security of SQL-Based Implementations of Product Data Exchange Using STEP


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Security Guidance for First Responder Mobile and Wearable Devices:

| MTD    | Mobile Threat Defense                          |
|--------|------------------------------------------------|
| MAC    | Media Access Control Address                   |
| MAV    | Mobile Application Vetting                     |
| NFC    | Near Field Communication                       |
| NIST   | National Institute of Standards and Technology |
| NPSBN  | Nationwide Public Safety Broadband Network     |
| OS     | Operating System                               |
| OUI    | Organizationally Unique Identifier             |
| PAN    | Personal Area Network                          |
| PIN    | Personal Identification Number                 |
| PMF    | Protected Management Frame(s)                  |
| PMK    | Pairwise Main Key                              |
| PTK    | Pairwise Transient Key                         |
| PITM   | Person in the Middle                           |
| PSCR   | Public Safety Communications Research          |
| PSK    | Pre-shared Key                                 |
| RFID   | Radio-Frequency Identification                 |
| RSN    | Robust Security Network                        |
| SNonce | Supplicant Number once                         |
| SP     | Special Publication                            |
| SSID   | Service Set Identifier                         |
| SSL    | Secure Sockets Layer                           |
| SSO    | Single Sign-on                                 |
| TLS    | Transport Layer Security                       |
| TPK    | Temporal Pairwise Key                          |

Gaps: Network and systems administrators must take note of the MAC address randomization feature during device enrollment to ensure proper device connectivity and tracking. When a mobile device connects to a Wi-Fi network, it will save the randomized MAC address into a network profile. Subsequent associations to the same Wi-Fi network will utilize the saved network profile information.

Security Guidance for First Responder Mobile and Wearable Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 2 requirements?

[Assistant]
According to Hardware Security Failure Scenarios_ Potential Hardware Weaknesses:

aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements

NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-11-04

## How to Cite this NIST Technical Series Publication

Mell P, Bojanova I (2024) Hardware Security Failure Scenarios: Potential Hardware Weaknesses. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8517. https://doi.org/10.6028/NIST.IR.8517

## Author ORCID iDs

Peter Mell: 0000-0003-2938-897X Irena Bojanova: 0000-0002-3198-7026

## Contact Information

nistir8517@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8517/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

Hardware is often assumed to be robust from a security perspective. However, chips are both created with software and contain complex encodings (e.g., circuit designs and firmware). This leads to bugs, some of which compromise security. This publication evaluates the types of vulnerabilities that can occur and leverages existing work on hardware weaknesses. For each type, a security failure scenario is provided that describes how the weakness could be exploited, where the weakness typically occurs, and what kind of damage could be done by an attacker.

Hardware Security Failure Scenarios_ Potential Hardware Weaknesses


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Approaches for Federal Agencies to Use the Cybersecurity Framework:

11 | AO | Authorizing Official | |-------|-------------------------------------------------------------------------------------------------------------------------------| | CI | Critical Infrastructure | | CIO | Chief Information Officer | | CISO | Chief Information Security Officer | | CNSS | Committee on National Security Systems | | EO | Executive Order | | FIPS | Federal Information Processing Standards | | FISMA | Federal Information Security Management Act of 2002, as amended, including the Federal Information Security Modernization Act | | HIPAA | Health Insurance Portability and Accountability Act | | HVA | High Value Asset | | ISCM | Information Security Continuous Monitoring | | ISO | International Organization for Standardization | | ITL | Information Technology Laboratory | | NIST | National Institute of Standards and Technology | | OMB | Office of Management and Budget | | POA&M | Plan of Action and Milestones | | RAR | Risk Assessment Report | | RFC | Request for Comment | | RFI | Request for Information | | RMF | Risk Management Framework | | SAR | Security Assessment Report | | SP | Special Publication | | SSP | System Security Plan |

Approaches for Federal Agencies to Use the Cybersecurity Framework


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Module-Lattice-Based Key-Encapsulation Mechanism Standard:

Both this standard and possible threats that reduce the security provided through the use of this standard will undergo review by NIST as appropriate, taking into account newly available analysis and technology. In addition, the awareness of any breakthrough in technology or any mathematical weakness of the algorithm will cause NIST to reevaluate this standard and provide necessary revisions.

Module-Lattice-Based Key-Encapsulation Mechanism Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Computer Security Division 2015 Annual Report:

ts biometric transactions based on NIST SP 500-290, and SP 500-290 Revision 1 - Data Format for the Interchange of Fingerprint, Facial & Other Biometric Information) received a substantial update.
Version 2.0 of the testing software was released and added  support  for  testing  for  the  remaining  traditionally encoded  record  types  not  previously  supported  (+12  for ANSI/NIST-ITL  1-2011,  and  +18  for  ANSI/NIST-ITL  1-2011 Update:  2013). Version  2.0  now  supports  all  traditionally encoded biometric record types between the two versions of  the  published  ANSI/NIST-ITL  standards. Additionally, Version  2.0  added  many  enhanced  editing  features  for traditionally  encoded  biometric  transactions  -  some  new features  include:  adding  and  removing  records  and  fields, arranging records and fields, automatically sorting records, displaying  the  biometric  sample  image,  and  enhanced binary  data  editing  features. In  addition  to  the  enhanced editing  features,  BioCTS  for  ANSI/NIST-ITL  received  many usability  enhancements,  as  well  as  updates  to  some  core software functionality, providing a more usable and robust testing tool.

Computer Security Division 2015 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.6 (NIST 3.2.6)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation:

3.2.6) • Added optional capability to use the Global PIN (in addition to the PIV Card Application PIN) with the PIV Card Application (Part 1, Sec. 3.2.6) • Added pivMiddlewareVersion API function (SP 800-73-5 Part 3, Sec.

Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-232

## Ascon-Based Lightweight Cryptography Standards for Constrained Devices

Authenticated Encryption, Hash, and Extendable Output Functions

Meltem Sönmez Turan Kerry A. McKay Donghoon Chang Jinkeon Kang John Kelsey

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-232

<!-- image -->

## NIST Special Publication 800 NIST SP 800-232

## Ascon-Based Lightweight Cryptography Standards for Constrained Devices

Authenticated Encryption, Hash, and Extendable Output Functions

Meltem Sönmez Turan Kerry A. McKay Jinkeon Kang* John Kelsey

Computer Security Division Information Technology Laboratory

* Former Foreign Guest Researcher; all work for this publication was done while at NIST. Donghoon Chang

Strativia

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-232

August 2025

<!-- image -->

U.S. Department of Commerce Howard Lutnick, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0:

| Function                                | Category                                                                                |                                                                                | Subcategory   |
|-----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| appropriate data processing safeguards. | and responsibilities in the data processing ecosystem, and management commitment), processes, and procedures are maintained and used to manage the protection of data. | PR.PO-P2: Configuration change control processes are established and in place.

NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Identity Proofing and Enrollment provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental
organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements
NIST Technical Series Publication Identifier Syntax

Publication History

Approved by the NIST Editorial Review Board on 2025-05-30. Supersedes NIST SP 800-63A (June 2017; updated March 2, 2020) https://doi.org/10. 6028/NIST.SP.800-63a

How to Cite this NIST Technical Series Publication

Temoshok D, Abruzzi C, Choong YY, Fenton JL, Galluzzo R, LaSalle C, Lefkovitz N,
Regenscheid A, Vachino M (2025) Digital Identity Guidelines: Identity Proofing and
Enrollment. (National Institute of Standards and Technology, Gaithersburg, MD), NIST
Special Publication (SP) NIST SP 800-63A-4. https://doi.org/10.6028/NIST.SP.800-63A-4

Author ORCID iDs

David Temoshok: 0000-0001-6195-0331
Christine Abruzzi: 0000-0001-8904-930X
Yee-Yin Choong: 0000-0002-3889-6047
James L. Fenton: 0000-0002-2344-4291
Ryan Galluzzo: 0000-0003-0304-4239
Connie LaSalle: 0000-0001-6031-7550
Naomi Lefkovitz: 0000-0003-3777-3106
Andrew Regenscheid: 0000-0002-3930-527X
Maria Vachino: 0000-0002-3494-5307

Contact Information

mailto:dig-comments@nist.gov

National Institute of Standards and Technology
Attn: Applied Cybersecurity Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/
sp/800/63/A/4/final, including related content, potential updates, and document
history. All comments are subject to release under the Freedom of Information Act (FOIA). NIST SP 800-63A-4
July 2025

Abstract

Digital Identity Guidelines
Identity Proofing and Enrollment

This guideline focuses on identity proofing and enrollment for use in digital
authentication.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.2.2. 3.2.2.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Recommendation for Stateful Hash-Based Signature Schemes:

| 1 Introduction ............................................................................................................1   | 1 Introduction ............................................................................................................1   | 1 Introduction ............................................................................................................1   |
|--------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | 1.1 Intended Applications for Stateful HBS                                                                                | Schemes........................................... 1                                                                           |
|                                                                                | 1.2 The Importance of the Proper Maintenance                                                                                | of State ...................................... 1                                                                              |
|                                                                                | 1.3 Outline of Text                                                                                | ................................................................................................

Recommendation for Stateful Hash-Based Signature Schemes


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Building a Cybersecurity and Privacy Learning Program:

Teaching the workforce about different cybersecurity and privacy risks enables them to effectively address the risks they encounter in their daily activities. For example, all members of the workforce will need training that helps them understand what a privacy event is and how one might occur within their organization. They should be able to identify and report a privacy event. Incident response professionals will need training that helps them determine when a cybersecurity incident may also be a privacy event, which often requires additional procedures when responding (e.g., determining if an unsecured site resulted in an actual privacy breach). - Understanding how cybersecurity and privacy activities support the organization's mission and business objectives
- Using proper passwords or multi-factor authentication
- Handling data
- Using AI or other enterprise tools
- Learning remote access procedures
- Collecting and protecting PII
- Reporting any suspected incidents or violations of cybersecurity and privacy policies
- Following the rules established to avoid social engineering attacks (e.g., ransomware and phishing) and to deter the spread of spam and malware
- Identifying and addressing privacy risks during information processing
- Knowing where to find the organization's cybersecurity and privacy resources and points of contact

- New employees: This audience includes contractors, and the focus is usually on the important policies and rules of behavior for the systems that they will access. This training includes what is typically called 'new employee orientation' or 'onboarding' and can be joint cybersecurity and privacy training. Some organizations may need to require visitors and/or guests to sign acceptable use policies if they allow them any type of system access, including use of wireless network connections.

Building a Cybersecurity and Privacy Learning Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Report of the Workshop on Cryptography in Support of Computer Security:

## Report of the Workshop on Cryptography in Support of Computer Security

## REPORT OF THE WORKSHOP ON CRYPTOGRAPHY IN SUPPORT OF COMPUTER SECURITY

Report of the Workshop on Cryptography in Support of Computer Security

Report of the Workshop on Cryptography in Support of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Key Management_ Part 1 – General provide? (Part 4)

[Assistant]
its collaborative activities with industry, government, and academic organizations. ## Abstract

This  Recommendation  provides  cryptographic  key-management  guidance. It  consists  of  three parts.
Part 1 provides general guidance and best practices for the management of cryptographic keying material, including definitions of the security services that may be provided when using cryptography  and  the  algorithms  and  key  types  that  may  be  employed,  specifications  of  the protection that each type of key and other cryptographic information requires and methods for providing  this  protection,  discussions  about  the  functions  involved  in  key  management,  and discussions about a variety of key-management issues to be addressed when using cryptography. Part  2  provides  guidance  on  policy  and  security  planning  requirements  for  U.S. government agencies. Part 3 provides guidance when using the cryptographic features of current systems. ## Keywords

archive; authentication; authorization; availability; backup; compromise; confidentiality; cryptographic key; cryptographic module; digital signature; hash function; key agreement; key management; key recovery; keying material; key transport; private key; public key; secret key; trust anchor. ## Acknowledgments

The  National  Institute  of  Standards  and  Technology  (NIST)  gratefully  acknowledges  and appreciates  contributions  by  previous  authors  of  this  document  on  the  many  security  issues associated with this Recommendation: William Barker, William Burr, and Timothy Polk from NIST; Miles Smid from Orion Security; and Lydia Zieglar from the National Security Agency. NIST also thanks the many contributions by the public and private sectors whose thoughtful and constructive comments improved the quality and usefulness of this publication. NIST especially appreciates the comments submitted before, during, and after the public comment period by Paul Turner from Venafi.

Recommendation for Key Management_ Part 1 – General


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio:

Some weaknesses, such as software flaws or misconfigurations, can be identified using automated scanners. These automated techniques may help to quickly identify some common vulnerabilities, but ICT weaknesses are not limited to enterprise hardware and software. For the ICT risk disciplines of privacy, supply chain, and cybersecurity, reviewing the controls described in NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations , may help highlight many potential weaknesses [SP80053].

OMB A-123 examples reference inherent risk that describes 'conditions in the absence of risk management actions.' There are often likely to be at least some elements that help mitigate risks, so this publication typically refers to current risk rather than inherent risk when representing a baseline risk posture.

Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Security of SQL-Based Implementations of Product Data Exchange Using STEP:

The basic SQL definition is ANSI X3. 135-1989, Database Language -SQL with Integrity Enhancement [ANS89a], and will be referred to as SQL'89. The functionality of SQL'89 includes schema definition, data manipulation, and transaction management. SQL'89 and ANSI X3. 168-1989, Database Language - Embedded SQL [ANS89b], form the basis for the Federal Information Processing Standard (FIPS) 127-1 [FIP90].

Section 3 identifies controls and mechanisms that can be used to address the concerns described in Section 2. These controls are organized according to an augmented Trusted Computer System Evaluation Criteria (TCSEC) model presented in [PB93]. This model reflects the Trusted Database Interpretation (TDI) [TDI91] and National Computer Security Center (NCSC) Technical Report 79-91, Integrity In Automated Information Systems [TR791]. The Interpreted Requirements presented in the TDI provide the basis for discussions of labels and audit in database. Additions to the model from TR 79-91 include the definitions of data integrity and systems integrity.

STEP itself does not imply any particular implementation form or security policy. Certain policies are more easily implemented with the SQL/STEP architecture than others. In Section 4, three broad classes of security policies are briefly described, accompanied by a comparison of particular requirements with the facilities of SQL. The policy classes are: a role based policy, a mandatory access control policy for confidentiality, and a mandatory access control policy for integrity.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to NIST Cloud Computing Forensic Science Challenges:

3.2.2                                                                                | 3. 3.2.2 Correlation Between Cloud Technology and Forensic Science Challenges

To better understand the correlation between the cloud forensic science challenges and their cloud-based root cause, the NCC FSWG analyzed each challenge's relationship to the cloud functional capabilities (cloud processes or solutions) identified in the Cloud Security Alliance's (CSA's) Enterprise Architecture (EA) [9]and leveraged by the NIST Cloud Security Reference Architecture (CSRA) [10].

NIST Cloud Computing Forensic Science Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach:

This publication can be used in conjunction with ISO/IEC/IEEE 15288:2015, Systems and
software engineering—Systems life cycle processes; NIST Special Publication (SP) 800-160,
Volume 1, Systems Security Engineering—Considerations for a Multidisciplinary Approach in the
Engineering of Trustworthy Secure Systems; NIST SP 800-37, Risk Management Framework for
Information Systems and Organizations—A System Life Cycle Approach for Security and Privacy;
and NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations. It
can be viewed as a handbook for achieving the identified cyber resiliency outcomes based on a
systems engineering perspective on system life cycle and risk management processes, allowing
the experience and expertise of the implementing organization to help determine how the
content will be used for its purpose. Organizations can select, adapt, and use some or all of the
cyber resiliency constructs (i.e., goals, objectives, techniques, approaches, and design principles)
described in this publication and apply the constructs to the technical, operational, and threat
environments for which systems need to be engineered. Advanced persistent threat; controls; cyber resiliency; cyber resiliency approaches; cyber
resiliency design principles; cyber resiliency engineering framework; cyber resiliency goals; cyber
resiliency objectives; cyber resiliency techniques; risk management strategy; system life cycle;
systems security engineering; trustworthiness. NIST SP 800-160, Volume 2, presents a cyber resiliency engineering framework to aid in
understanding and applying cyber resiliency, a concept of use for the framework, and the
engineering considerations for implementing cyber resiliency in the system life cycle. The
framework constructs include goals, objectives, techniques, implementation approaches, and
design principles.

Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Recommendations for Key-Encapsulation Mechanisms:

The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops tests,
test methods, reference data, proof of concept implementations, and technical analyses
to advance the development and productive use of information technology. ITL’s respon-
sibilities include the development of management, administrative, technical, and physical
standards and guidelines for the cost-effective security and privacy of other than national
security-related information in federal information systems.  The Special Publication 800-
series reports on ITL’s research, guidelines, and outreach efforts in information system se-
curity, and its collaborative activities with industry, government, and academic organiza-
tions.

termeasures (i.e., does not satisfy condition 2) or is deployed on a device with physical
vulnerabilities (i.e., does not satisfy condition 3) is likely to be insecure in practice.

Cryptographic module implementation.  The implementations of Π used by Alice
and Bob need to satisfy the requirements in Sec. 3.  Whether a given implemen-
tation is sufficiently secure is an application-dependent question.  For example, an
implementation might be secure enough for use on a web server in a physically se-
cure location but have insufficient side-channel protections for use on an embedded
device.

Recommendations for Key-Encapsulation Mechanisms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case provide? (Part 4)

[Assistant]
butions from individuals and organizations in the public and private sectors, whose thoughtful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication.
A special acknowledgement to the members of the ISA99, Industrial Automation and Control Systems Security Committee and the Department of Homeland Security Industrial Control System Joint Working Group (ICSJWG) for their exceptional contributions to this publication. ## Note to Readers

This guide describes a proof-of-concept solution for securing manufacturing environments that has only been tested in a lab environment. Manufacturers should make their own determinations about the breadth of the proof-of-concept solutions they voluntarily implement. Some important factors to consider include: company size, cybersecurity expertise, risk tolerance, and the threat landscape. We welcome feedback on its contents and your input. Comments, suggestions, and success stories will improve subsequent versions of this guide. Please contribute your thoughts to CSF\_Manufacturing\_Profile\_Implementation@nist.gov. ## Revision to Include Updates in Cybersecurity Framework Version 1.1

The Cybersecurity Framework Manufacturing Profile, NISTIR 8183, was drafted and released when the Cybersecurity Framework was at Version 1.0. This guide provides implementation guidance and example proof-of-concept solutions with respect to the language in the original Cybersecurity Framework Manufacturing Profile. The Cybersecurity Framework Manufacturing Profile, NISTIR 8183, is scheduled to be revised to include the updates in the Cybersecurity Framework Version 1.1, and will be published as NISTIR 8183, Revision 1. Once NISTIR, 8183, Revision 1 has been released, this implementation guide will be revised to include the updates in the Cybersecurity Framework Version 1.1 as well, and will be published as NISTIR 8183A, Revision 1.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.4 (NIST 3.5.4)?

[Assistant]
According to Attribute Considerations for Access Control Systems:

3.5.4                                                                                | Integration with Authentication ... 3.5.4 Integration with Authentication

The shift from internal to public-based hosting (e.

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................4 |
| 2. HIPAA Security Rule .......................................................................................................................9     |
| 3. Risk Assessment Guidance............................................................................................................14           |
| 4. Risk Management Guidance .........................................................................................................24             |
| 5. Considerations When Implementing the HIPAA Security Rule........................................................28                               |
| 5.1.2. Assigned Security Responsibility (§ 164.308(a)(2)) ....................................................................35                    |
| 5.1.3. Workforce Security (§ 164.308(a)(3)).........................................................................................36              |
| 5.1.4. Information Access Management (§ 164.308(a)(4)) ..................................................................38                         |
| 5.1.5. Security Awareness and Training (§ 164.308(a)(5)) ...................................................................41                      |
| 5.1.6. Security Incident Procedures (§ 164.308(a)(6)) .........................................................................44                   |
| 5.1.7. Contingency Plan (§ 164.308(a)(7))............................................................................................47             |
| 5.1.8.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

The National Institute of Standards and Technology (NIST) hosted an in-person, all-day workshop on February 27, 2024, to discuss existing and emerging cybersecurity threats and mitigation techniques for semiconductors throughout their life cycle. The workshop obtained valuable feedback from industry, academia, and government to inform NIST's development of cybersecurity and supply chain standards, guidance, and recommended practices. The discussion focused on semiconductor development and highlighted cybersecurity measurements and metrics that utilize reference data sets to facilitate the testing, attestation, certification, verification, and validation of semiconductor components. It also emphasized the use of automated cybersecurity tools and techniques to secure manufacturing environments throughout the development life cycle. This report summarizes the content that was presented and discussed at the workshop. These activities range from physical protection mechanisms (e.g., tamper-resistant packaging) to strong encryption protocols to safeguard data. Secure boot processes ensure that only verified firmware runs, and maintaining supply chain integrity through verification and audits prevents counterfeit components. Life cycle management includes secure provisioning, updates, and end-of-life processes that are complemented by rigorous security testing and compliance with regulatory standards. Educating users on secure practices and continuously improving security measures further fortifies defenses against evolving threats and ensures that semiconductor devices operate securely throughout their life cycle. Furthermore, Jonathan stressed the importance and continued need for public-private partnerships, like the Semiconductor Research Corporation and the Semiconductor Industry Association.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide to Cyber Threat Information Sharing:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national securityrelated information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Each organization should establish an information sharing plan that provides for ongoing infrastructure maintenance and user support. The plan should address the collection and analysis of threat information from both internal and external sources and the use of this information in the development and deployment of protective measures.

Guide to Cyber Threat Information Sharing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to IT Security for Industrial Control Systems:

The Process Control Security Requirements Forum (PCSRF) is a working group comprising representative organizations from the various sectors that make up the U.S. Process Control Industry and the vendors that design, produce, and/or integrate components and systems for the industry. The PCSRF is working with security professionals to assess the vulnerabilities and establish appropriate strategies for the development of policies and countermeasures that the U.S. process controls industry would employ through a combination IT and non-IT mechanisms to reduce residual risk to an acceptable level. The Common Criteria for Information Technology Security Evaluation, also known as ISO/IEC 15408. is being used to document the results of this effort in the form of Common Criteria Protection Profile security specifications. Primary focus area of the group to improve the IT security of the computer control systems used in process industries, including electric utilities, petroleum (oil & gas), water, waste, chemicals, pharmaceuticals, pulp & paper, and metals & mining with an emphasis on industries considered to be part of the Nation's Critical Infrastructure. The Common Criteria (CC), ISO/IEC 15408 [7], is a meta-standard of criteria and constructs used to develop security specifications in support of the evaluation of products and systems. The specifications define and characterize the security problem including assumptions about the operational environment, threats that must be encountered and policies that must be enforced. Also characterized is the intended approach to eliminate, minimize or monitor defined threats, and enforce stated policy. The specification defines functional requirements, specifying what the system is to do and assurance requirements, specifying what is done to verify that the system does exactly what it is supposed to. These CC requirements, selected from a catalog of criteria, are independent of technology and implementation.

IT Security for Industrial Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Introduction to Cybersecurity for Commercial Satellite Operations:

Design and development. Is it important to have robust software and hardware design processes where developers add in security and perform proper security testing. Manufactures and companies should be aware of the long lifetime of some spacecraft and build in flexibility to address cyber threats over the lifetime of the vehicle. Specific attention should be placed on the cryptographic modules that may potentially allow for upgrades for post-quantum cryptography. Current operationally deployed systems should also consider using compensating controls to achieve outcomes if the legacy technologies are insufficient. The organization then generates a high-level cybersecurity risk model that can help identify its most severe cybersecurity vulnerabilities, the threat events that are most likely to occur, and events that could have the highest negative impact on the business. This analysis is less rigid than the detailed risk evaluation that occurs in Step 4 and is intended to spur discussion regarding the types of risk events that might have some impact on the organization. The resulting risk understanding helps shape the Current State Profile described in Step 3. | Functions   | Subcategories                                                                                | Informative SP 800-53, Rev. 4                      | Reference SP 800-53, Rev.

Introduction to Cybersecurity for Commercial Satellite Operations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Research Report_ User Perceptions of Smart Home Privacy and Security:

understanding of smart home device technology, functionalities, and privacy and security, there may be little meaningful mitigation actions being taken to protect consumer security and privacy [7-10].
| Mitigation                        |   # | Examples                                                                                |
|-----------------------------------|-----|------------------------------------------------------------------------------------------------------------------------------|
| Authentication                    |  17 | setting or changing passwords on device apps, using facial recognition / biometrics                                          |
| Limiting audio and video exposure |  16 | not locating devices in certain rooms, restricting conversations when near devices, unplugging devices in certain situations |
| Home network configuration        |  14 | network segmentation, setting a Wi-Fi pass- word, using virtual private networks (VPNs)                                      |
| Configuring device options        |  12 | disabling automatic ordering, history, and er- ror reporting                                                                 |
| Limiting information in apps      |   8 | using fake information or infrequently-used email addresses                                                                  |
| Device selection                  |   7 | choosing devices with strong security / privacy features, buying products from trusted vendors                               |
| Limiting access                   |   5 | limiting access to codes / passwords, placing orders from computer instead of from virtual assistant                         |
| Updates                           |   3 | applying app and firmware updates, upgrading products                                                                        |

Research Report_ User Perceptions of Smart Home Privacy and Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U provide? (Part 2)

[Assistant]
ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to NIST Cloud Computing Forensic Reference Architecture:

ntracts and service-level agreements
- o Issuing subpoenas without knowledge of the physical location of data
8. Standards (e.g., standard operating procedures, interoperability, testing, validation).
Standards challenges in cloud forensics include:
- o Lack of minimum/basic SOPs, practices, and tools
- o Lack of interoperability among cloud providers
- o Lack of test and validation procedures
9. Training (e.g., forensic investigators, cloud providers, qualification, certification). Training challenges in cloud forensics include:
- o Misuse of digital forensic training materials that are not applicable to cloud forensics
- o Lack of cloud forensic training and expertise for both investigators and instructors

NIST Cloud Computing Forensic Reference Architecture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities provide?

[Assistant]
## NISTIR 8420B

## The Federal Cybersecurity Awareness Workforce

Professional Backgrounds, Knowledge, Skills, and Development Activities

Julie Haney Jody Jacobs Susanne Furman Fernando Barrientos

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8420B

<!-- image -->

## NISTIR 8420B

## The Federal Cybersecurity Awareness Workforce

Professional Backgrounds, Knowledge, Skills, and Development Activities

Julie Haney Jody Jacobs Susanne Furman Fernando Barrientos Information Access Division Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8420B

March 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8420B 36 pages (March 2022)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8420B

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. | 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Usability and Security Considerations for Public Safety Mobile Authentication:

In the United States over 10 000 jurisdictions employ public safety personnel to respond to emergency situations every day. These first responders treat life-threatening injuries, deal with the consequences of natural disasters, fight crime, and combat terrorism. To perform these duties, emergency responders must undergo unique training, utilize specialized equipment, and access a variety of information systems. The use of specialized tools, information systems, and protective equipment places first responders within a unique environment to perform their jobs. - Section 2, Usability of Authentication for Public Safety: Discusses why usability is critical for public safety, describes the usability research methodology, and explains qualitative data from public safety subject matter experts (SMEs). - Section 3, Fire Service, EMS, and Law Enforcement: Briefly describes Fire, EMS, and Law Enforcement, including specialized equipment for each. Discusses the current authentication practices for public safety personnel. - Section 4, Authentication Methods Under Review: Describes a variety of authentication methods under review within this analysis. - Section 5, Usability and Technical Considerations of Authentication Methods: Discusses the usability and technical considerations of authentication methods under review. In many cases, the considerations are similar across Fire, EMS, and Law Enforcement disciplines. - Section 6, Discussion and Future Directions: Summarizes the analysis of authentication methods for Fire, EMS, and Law Enforcement. Rates each method as impractical, challenging, or feasible for public safety. Discusses overarching concepts, potential mitigations, and identifies directions for future research. It is common to begin with qualitative research to understand users' characteristics, needs, tasks, and environments.

Usability and Security Considerations for Public Safety Mobile Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Computer Security Division 2008 Annual Report:

| Computer Security Division Publications - FY 2008 | 53 55 | | Ways to Engage Our Division and NIST | | | Acknowledgements | 56 |

Computer Security Division 2008 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Glossary of Key Information Security Terms provide? (Part 4)

[Assistant]
,  NIST  Special  Publications  (SPs),  and  select  NIST  Internal  or Interagency  Reports  (IRs),  as  well  as  from  the  Committee  on  National  Security  Systems Instruction 4009 (CNSSI-4009).
This repository ('the Glossary') contains two main parts: an online user interface application and an underlying database. The database, used as the foundation for the online application, contains terms and definitions extracted verbatim from NIST FIPS, SPs, and IRs, as well as from CNSSI4009. The online application was developed to allow users to search the database of terms and definitions. The  Glossary  is  intended  to  help  users  understand  terminology,  recognize  when  and  where multiple definitions may exist, and identify a definition that they can use. Over time, use of this Glossary will help standardize terms and definitions used, reducing confusion and the tendency to create unique definitions for different situations. This publication provides a broad overview of the Glossary's design. It describes the methodology, assumptions, and constraints used in the development of the underlying database and associated online user interface application (available at https://csrc.nist.gov/glossary). Specific implementation details are out of scope of this publication. This publication differs significantly from previous versions of NIST IR 7298. Previous versions contained a subset of basic terms that were most frequently used in NIST publications. This method was valuable, but greater demand and frequent updates to NIST's publication suite has necessitated the adoption of a more flexible solution. The audience for this publication also significantly differs from previous versions of NIST IR 7298.

Glossary of Key Information Security Terms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Virtual Network Configuration for Virtual Machine (VM) Protection provide? (Part 2)

[Assistant]
f Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States.
Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-125B Natl. Inst. Stand. Technol. Spec. Publ. 800-125B, 30 pages (March 2016) CODEN: NSPUE2

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-125B

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There  may  be  references  in  this  publication  to  other  publications  currently  under  development  by  NIST  in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until  each  publication  is  completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies  may  wish to closely  follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at http://csrc.nist.gov/publications.

Secure Virtual Network Configuration for Virtual Machine (VM) Protection


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Evaluating Differential Privacy Guarantees provide? (Part 5)

[Assistant]
| Differential Privacy Guarantee . | . . . . . . . . . . . . . . |   9 |
| 2.1. | The Promise of Differential Privacy                              | . . . . . . . . . . .
|   9 |
|                                                      | 2.1.1. | The Math of Differential Privacy . . . . . . . . |  11 |
|                                                      | 2.1.2. | Properties of Differential Privacy . . . . . . . . |  12 |
| 2.2. | The Privacy Parameter ε . | . . . . . . . . . . . . . . . . |  13 |
| 2.3. | Variants of Differential Privacy . | . . . . . . . . . . . . . |  16 |
| 2.4. | The Unit of Privacy . . . . . . | . . . . . . . . . . . . . . |  20 |
|                                                      | 2.4.1. | Bounded and Unbounded Differential Privacy                       |  20 |
|                                                      | 2.4.2. | Defining One Person's Data . . . . . . . . . . . |  21 |
| 2.5. | Comparing Differential Privacy Guarantees . | . . . . . . |  25 |
| 2.6. | Mixing Differential Privacy With Other Data Releases . . . | Mixing Differential Privacy With Other Data Releases . . . |  27 |
| 2.7. | Auditing and Empirical Measures of Privacy                       | . . . . . . |  28 |
| 3. Differentially Private Algorithms . . . . . . . . | 3. Differentially Private Algorithms . . . . . . . . | . . . . . . . . |  29 |
| 3.1. | Basic Mechanisms and Common Elements . | . . . . . . |  29 |
| 3.2. | Utility and Accuracy . . . | . . . . . . . . . . . . . . . . . |  31 |
| 3.3. | Bias . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . |  35 |
|                                                      | 3.3.1. | Systemic Bias . . . . . . . . . . . . . . . . . . . |  36 |
|                                                      | 3.3.2. | Human Bias . . . . . . . . . . . . . . . . . . . . |  37 |
|                                                      | 3.3.3. | Statistical Bias . . . . . . . . . . . . . . . . . .

Guidelines for Evaluating Differential Privacy Guarantees